CVE-2026-48187

Email with special content can lead to DoS

Published Jun 1, 2026 CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Description

An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows excessive allocation which may lead to the abortion of the webserver.This issue affects OTRS:

* 8.0.X
* 2023.X
* 2024.X
* 2025.X
* 2026.X before 2026.4.X

Please note that ((OTRS)) Community Edition 6.x, OTRS 7.x and products based on the ((OTRS)) Community Edition also very likely to be affected

Analysis

Technical impact

An uncontrolled allocation of resources occurs during e‑mail handling in OTRS, allowing an attacker to trigger excessive resource consumption that can cause the webserver to abort. This results in a denial of service to all users of the affected OTRS instance. The weakness is a resource‑management flaw (CWE‑400) and a potential exhaustion of allocation limits (CWE‑770).

Affected Systems

The vulnerability affects OTRS versions 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.4.X. It is also very likely to impact OTRS Community Edition 6.x, OTRS 7.x, and any products derived from the Community Edition.

Risk and Exploitability

The CVSS score of 5.7 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker may trigger the DoS by sending specially crafted e‑mail messages to the OTRS instance, exploiting the lack of resource limits.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OTRS AG

OTRS

unknown

Version	Status	Constraints
`7.0.x`	unknown	—
`8.0.x`	affected	—
`2023.x`	affected	—
`2024.x`	affected	—
`2025.x`	affected	—
`2026.x`	affected	≤ 2026.3.x

OTRS AG

((OTRS)) Community Edition

unknown

Version	Status	Constraints
`6.x`	unknown	—

Configuration 1 [-]

OR	cpe:2.3:a:otrs:otrs:::::community:::*
	cpe:2.3:a:otrs:otrs::::::::
	cpe:2.3:a:otrs:otrs::::::::

No data.

Vendor Product Versions

Otrs

Version	Status	Scheme	Platform
`[7.0.0,7.1.0)`	unknown	semver	—
`[8.0.0,8.1.0)`	affected	semver	—
`[2023.0.0,2024.0.0)`	affected	semver	—
`[2024.0.0,2025.0.0)`	affected	semver	—
`[2025.0.0,2026.0.0)`	affected	semver	—
`[2026.0.0,2026.4.0)`	affected	semver	—

Otrs

Otrs Community Edition

Version	Status	Scheme	Platform
`[6.0.0,7.0.0)`	unknown	semver	—

Remediation

Vendor Solution

Update to OTRS 2026.4.1. or later. Please note that there will be no OTRS 7 patches

OpenCVE Recommended Actions

Upgrade OTRS to version 2026.4.1 or later
Temporarily block or limit inbound email sources that send large volumes until the patch is applied
Implement rate‑limiting or firewall rules on the OTRS mail handling service to reduce the impact of excessive email processing

Generated by OpenCVE AI on June 1, 2026 at 06:23 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.185% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://otrs.com/release-notes/otrs-security-advisory-2026-06/

History

Jun 15, 2026 1:00 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:otrs:otrs:::::::: cpe:2.3:a:otrs:otrs:::::community:::*

Jun 3, 2026 2:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Otrs Otrs otrs Otrs otrs Community Edition
Vendors & Products		Otrs Otrs otrs Otrs otrs Community Edition

Jun 1, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 1, 2026 4:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows excessive allocation which may lead to the abortion of the webserver.This issue affects OTRS: * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X Please note that ((OTRS)) Community Edition 6.x, OTRS 7.x and products based on the ((OTRS)) Community Edition also very likely to be affected
Title		Email with special content can lead to DoS
Weaknesses		CWE-400 CWE-770
References		https://otrs.com/release-notes/otrs-security-advisory-2026-06/
Metrics		cvssV3_1 `{'score': 5.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H'}`